Privacybeleid

Last updated: 2026-07-23

1. Introduction

CIATAU is a brand of MB RWY07 ("MB RWY07", "CIATAU", "we", "us", "our", or the "Company"), a small partnership (mažoji bendrija) registered in the Republic of Lithuania. We respect your right to privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit or make a purchase from ciatau.com (the "Site") or otherwise interact with us (collectively, the "Services").

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Law of the Republic of Lithuania on the Legal Protection of Personal Data ("LLPPD"), the Law of the Republic of Lithuania on Electronic Communications ("LEC"), and other applicable data protection legislation, including, where relevant to specific visitors, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA").

Please read this Privacy Policy carefully. If you do not agree with its terms, please do not use the Services.

2. Definitions

  • "Data Subject" ("you", "your") — a natural person whose personal data we collect, including a customer, prospective customer, or visitor to the Site.
  • "Personal Data" — any information relating to an identified or identifiable natural person.
  • "Data Controller" — CIATAU, which determines the purposes and means of processing your Personal Data.
  • "Data Processor" — a third party that processes Personal Data on our behalf and under our instructions (for example, our hosting or payment providers).
  • "Third Party" — any person or entity other than you or the Data Controller.
  • "Processing" — any operation performed on Personal Data, such as collection, storage, use, disclosure, or erasure.

3. Who We Are and How to Contact Us

The Data Controller responsible for your Personal Data is MB RWY07, a small partnership (mažoji bendrija) registered in the Republic of Lithuania, trading as CIATAU. If you have any questions about this Privacy Policy or how we handle your Personal Data, or if you would like to exercise any of the rights available to you, please contact us at:

Email: hello@ciatau.com

Company registration code: 306693258
Registered address: Saltoniškių g. 44-65, LT-08106 Vilnius, Lithuania

4. What Personal Data We Collect

4.1 Information You Provide Directly

  • Contact details — name, address, phone number, email address.
  • Order information — billing and shipping address, payment confirmation, order history.
  • Account information — username, password, and other account security details, if you create an account.
  • Customer support information — the content of any messages you send us.

Providing this information is generally necessary to use certain features of the Services; if you choose not to provide it, we may be unable to offer you those features (for example, processing an order).

4.2 Information Collected Automatically

When you use the Site, we automatically collect certain technical information about your device and interaction with the Site ("Usage Data") using cookies and similar technologies, including your IP address, browser type, device information, and pages visited. See Section 8 (Cookies) below.

4.3 Information from Third Parties

We may receive information about you from service providers who support our Site and Services, such as Shopify (our e-commerce platform) and our payment processors, who collect payment details necessary to process your order.

5. Purposes and Legal Bases for Processing

We process your Personal Data only where we have a valid legal basis to do so under the GDPR. The list below summarizes our main processing activities.

Order fulfilment and account management
To process payments, fulfil orders, arrange shipping, handle returns, and manage your account. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR).

Customer support and service improvement
To respond to your enquiries and improve our Services. Legal basis: our legitimate interest in providing effective customer service (Art. 6(1)(f) GDPR).

Security and fraud prevention
To detect and prevent fraudulent, illegal, or malicious activity. Legal basis: our legitimate interest in keeping the Site and our customers secure (Art. 6(1)(f) GDPR).

Marketing communications
Where you choose to sign up to our newsletter or otherwise opt in, we use your email address to send you marketing communications, such as updates about new products, collections, or offers. We only send marketing emails to those who have given explicit, opt-in consent (for example, by checking an unticked box at signup); we do not add you to marketing lists automatically. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time, free of charge, by using the unsubscribe link in any marketing email or by contacting us directly (see Section 10).

Legal compliance
To comply with our legal obligations, such as tax and accounting requirements. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

6. How We Disclose Personal Data

We may disclose your Personal Data to:

  • Data Processors who perform services on our behalf, such as our e-commerce platform (Shopify), payment processors, and delivery/fulfilment partners, under contractual obligations to protect your data.
  • Public authorities, where required by applicable law or in response to valid legal requests.
  • A successor entity, in the event of a merger, acquisition, or sale of assets.

We disclose Personal Data only as described in this Privacy Policy, only to the extent necessary for the purposes set out above, and never to third parties for their own independent marketing purposes without your consent.

7. International Data Transfers

Some of our service providers may process your Personal Data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses, or we transfer data only to countries recognized by the European Commission as providing an adequate level of protection.

8. Cookies

Under Lithuanian and EU law, the use of non-essential cookies requires your prior consent (an "opt-in" principle). We ask for your consent through the cookie banner shown when you first visit the Site, where you can accept or decline non-essential cookies, and adjust your choices at any time.

Cookies that are strictly necessary for the Site's technical operation (for example, to remember items in your cart) do not require consent. We also use functional, analytics, and marketing cookies where you have consented. For details about cookies related to our Shopify platform, see: https://www.shopify.com/legal/cookies.

Our Site also recognizes the Global Privacy Control (GPC) signal as a valid opt-out request for sharing and targeted advertising, to the extent applicable.

9. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy. Specific retention periods depend on the category of data and purpose of processing:

  • Order and invoice records — retained in accordance with the retention periods set out in the General Document Retention Schedule approved by the Chief Archivist of Lithuania, and applicable Lithuanian accounting and tax law.
  • Account information — retained for as long as your account remains active, and for a reasonable period afterward in case you wish to reactivate it.
  • Marketing consent data — retained until you withdraw your consent or unsubscribe, or after an extended period of inactivity.
  • Customer support communications — retained for a reasonable period after the matter is resolved, in case of follow-up queries.

Where Personal Data is needed as evidence in connection with a legal claim, dispute, or investigation (including by the VDAI), we may retain it for as long as necessary for that purpose, and delete it promptly once it is no longer required.

10. Your Rights

Under the GDPR, you have the following rights regarding your Personal Data, subject to certain exceptions:

  • Right of access — to obtain confirmation of and access to the Personal Data we hold about you.
  • Right to rectification — to have inaccurate Personal Data corrected.
  • Right to erasure ("right to be forgotten") — to request deletion of your Personal Data where certain conditions apply.
  • Right to restrict processing — to request that we limit how we use your Personal Data.
  • Right to data portability — to receive your Personal Data in a structured, commonly used format and to have it transferred to another controller.
  • Right to object — to object to processing based on our legitimate interests, including for direct marketing.
  • Right to withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at hello@ciatau.com. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

Right to lodge a complaint
If you believe we have not handled your Personal Data in accordance with applicable law, you have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, "VDAI"):

L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania — www.vdai.lrv.lt

If you are located in another EEA country, you may also have the right to lodge a complaint with your local supervisory authority.

11. Children's Data

The Services are not directed at children, and we do not knowingly collect Personal Data from children. Under Lithuanian law, the age of consent for information society services is 14. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us at hello@ciatau.com so we can delete it.

12. Additional Rights for California Residents

If you are a California resident, the CCPA/CPRA may provide you with additional rights, including the right to know what categories of Personal Data we have collected, sold, or shared about you; the right to delete Personal Data we hold about you; the right to correct inaccurate Personal Data; and the right to opt out of the "sale" or "sharing" of your Personal Data, or its use for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not sell Personal Data for money. Some of our advertising and analytics integrations may constitute a "sale" or "sharing" under the CCPA/CPRA's broad definitions; if so, you may opt out by contacting us at hello@ciatau.com. We will not discriminate against you for exercising any of these rights.

13. Security

We implement reasonable technical and organizational measures to protect your Personal Data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We recommend that you avoid sending sensitive information to us through insecure channels.

14. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any Personal Data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the revised policy on the Site and update the "Last updated" date above.

16. Governing Language

This Privacy Policy may be made available in multiple languages for your convenience. In the event of any conflict or inconsistency between the English version and a translated version, the English version shall govern and take precedence.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at hello@ciatau.com.